Incident Response KitData leaked to an AI tool: incident response playbook
Use it when: Confidential or personal data, source code or a secret was pasted or uploaded into an AI tool that isn't approved for it, or an AI tool shared it with someone it shouldn't.
First 15 minutes
- Record what data, which tool, which account and when.
- Delete the conversation or data in the tool if possible, and check the tool's retention and training settings.
- Revoke the tool's access to company accounts, files and APIs.
- Rotate any secrets or keys that were exposed.
Set the severity and download a first-response checklist
What the full playbook covers
- Contain (2 steps)
- Eradicate (2)
- Recover (1)
- Who to notify
- Evidence to keep
The full playbook is in the Incident Response & Business Continuity Kit with 11 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.
Other playbooks
- Phishing and business email compromise
- Ransomware
- Lost or stolen device
- Data sent to the wrong person or exposed
- Compromised account or cloud admin access
- Malware on a device
- Major outage or denial of service
- Supplier or third-party breach
- Rogue or misbehaving AI agent
- Prompt injection against an AI assistant or agent
- Deepfake or voice-clone payment fraud